Security Patch Advisor

Security Patch Advisor

Overview

This skill analyzes security vulnerabilities and provides comprehensive remediation strategies without automatically modifying code. It offers multiple remediation approaches with detailed trade-off analysis, code examples, and implementation guidance for vulnerabilities categorized by CWE (Common Weakness Enumeration) and severity.

When to Use This Skill

Use this skill when you need:

• Remediation strategies for detected security vulnerabilities
• Safer API alternatives for insecure code patterns
• Design-level security improvements
• Multiple remediation approaches with trade-offs
• Code examples showing before/after fixes
• Prioritized remediation plans based on severity and impact
• Security best practices for specific vulnerability types

Trigger scenarios:

• After running static analysis tools (SAST)
• After security audits or penetration testing
• When reviewing code for security issues
• When planning security improvements
• After vulnerability disclosure or CVE reports

Core Workflow

1. Vulnerability Analysis

When presented with a security vulnerability, analyze:

Context Gathering:

• Vulnerability type and CWE classification
• Severity level (Critical, High, Medium, Low)
• Affected code location and scope
• Current implementation details
• Attack vectors and exploitation scenarios
• Business impact and data sensitivity

Questions to Consider:

• What is the root cause of the vulnerability?
• What data or systems are at risk?
• What are the prerequisites for exploitation?
• Are there existing security controls?
• What is the attack surface?

2. Remediation Strategy Development

Provide multiple remediation approaches:

Strategy Components:

1. Primary Remediation (recommended approach)

   • Specific code changes required
   • Safer API alternatives
   • Security controls to implement
   • Validation and sanitization logic

2. Alternative Approaches

   • Different implementation strategies
   • Framework-specific solutions
   • Defense-in-depth measures
   • Compensating controls

3. Design-Level Changes

   • Architectural improvements
   • Security patterns to adopt
   • System-level mitigations
   • Infrastructure changes

For Each Strategy, Include:

• ✅ Benefits and security improvements
• ⚠️ Trade-offs and limitations
• 📊 Implementation complexity
• ⚡ Performance impact
• 🔧 Required dependencies or tools
• 📚 Relevant security standards (OWASP, CWE, NIST)

3. Code Examples

Provide concrete before/after examples:

Example Structure:

### Vulnerable Code
[Show the insecure code with clear vulnerability markers]

**Vulnerability:** CWE-XXX (Name)
**Risk:** [Explain the security risk]
**Attack Example:** [Show how it could be exploited]

### Remediated Code (Approach 1)
[Show the fixed code with security improvements]

**Changes:**
- [List specific changes made]
- [Explain security mechanisms added]

**Trade-offs:**
- ✅ [Benefits]
- ⚠️ [Limitations or considerations]

### Alternative Remediation (Approach 2)
[Show alternative fix if applicable]

**Trade-offs:**
- ✅ [Benefits]
- ⚠️ [Limitations or considerations]

4. Implementation Guidance

Provide step-by-step implementation instructions:

Guidance Should Include:

1. Prerequisites

   • Required libraries or dependencies
   • Configuration changes needed
   • Environment setup

2. Implementation Steps

   • Ordered list of changes
   • Code modifications required
   • Testing procedures

3. Verification

   • How to verify the fix works
   • Security testing recommendations
   • Regression testing considerations

4. Deployment Considerations

   • Backward compatibility
   • Migration strategy
   • Rollback plan

5. Prioritization and Risk Assessment

Help prioritize remediation efforts:

Prioritization Factors:

• Severity: CVSS score, exploitability, impact
• Exposure: Public-facing vs internal, attack surface
• Data Sensitivity: PII, credentials, financial data
• Ease of Exploitation: Skill level required, available exploits
• Business Impact: System criticality, user impact
• Remediation Effort: Development time, testing requirements

Priority Levels:

• P0 (Critical): Immediate action required (active exploitation, critical systems)
• P1 (High): Fix within days (high severity, exposed systems)
• P2 (Medium): Fix within weeks (moderate risk, mitigating controls exist)
• P3 (Low): Fix in next release cycle (low risk, defense in depth)

Vulnerability Categories

Buffer Overflow Vulnerabilities

• CWE-120: Buffer Copy without Checking Size
• CWE-121: Stack-based Buffer Overflow
• CWE-122: Heap-based Buffer Overflow
• CWE-787: Out-of-bounds Write

Common Remediations:

• Use safe string functions (strncpy, snprintf)
• Implement bounds checking
• Use memory-safe languages or libraries
• Enable compiler protections (stack canaries, ASLR)

Injection Vulnerabilities

• CWE-89: SQL Injection
• CWE-78: OS Command Injection
• CWE-79: Cross-Site Scripting (XSS)
• CWE-91: XML Injection
• CWE-94: Code Injection

Common Remediations:

• Use parameterized queries/prepared statements
• Implement input validation and output encoding
• Use safe APIs instead of shell execution
• Apply Content Security Policy (CSP)
• Use ORM frameworks with built-in protections

Insecure Deserialization

• CWE-502: Deserialization of Untrusted Data

Common Remediations:

• Use data-only formats (JSON, XML)
• Implement integrity checks (HMAC signatures)
• Whitelist allowed classes
• Avoid deserializing untrusted data

Authentication & Authorization

• CWE-287: Improper Authentication
• CWE-306: Missing Authentication
• CWE-862: Missing Authorization
• CWE-798: Hard-coded Credentials
• CWE-522: Insufficiently Protected Credentials

Common Remediations:

• Implement multi-factor authentication
• Use secure session management
• Implement proper authorization checks
• Use environment variables or secret management
• Hash passwords with bcrypt/Argon2

Cryptographic Issues

• CWE-327: Use of Broken Cryptography
• CWE-328: Weak Hash
• CWE-330: Insufficient Randomness
• CWE-326: Inadequate Encryption Strength

Common Remediations:

• Use modern algorithms (AES-256, SHA-256, RSA-2048+)
• Use cryptographically secure random number generators
• Implement proper key management
• Use authenticated encryption (GCM, CCM)

Memory Safety

• CWE-416: Use After Free
• CWE-476: NULL Pointer Dereference
• CWE-415: Double Free
• CWE-401: Memory Leak

Common Remediations:

• Use smart pointers (C++)
• Nullify pointers after free
• Use memory-safe languages
• Enable AddressSanitizer for testing